ID. Date of interview 
date = 19/12/19 


ID. Time interview started 
start 16:42:27 


ID.end Completion date of interview 
Date 19/12/19 


ID.end Time interview ended 
16:54:22 


ID. Duration of interview 
time 41.92 


Start of new case 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
© Yes 
—) No 

©) Unsure / don't know 

If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


Q4 


Q5 


Q6 


Q7 


We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 


unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 

from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 

requests below (if applicable). 


On a scale of 1-5 how useful is the draft guidance? 


1-Notatall 2- Slightly Moderately 4-Very 5- Extremely 
useful useful useful useful useful 


Why have you given this score? 


It's helpful to know the ICO's views on things. Even if it is just to confirm what you 
think the ICO will say when they update their guidance. But given the circumstances 


it really isn't that useful because professionals will have worked it out for 
themselves. 


To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


C) () ( ) o) © 


Q8 


Q9 


Q10 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


I disagree with this paragraph on page 4: "When responding to a subject access 
request (SAR), you must remember to supply this information in addition to a copy 
of the personal data itself." I do not see that the legislation requires you to 
proactively provide this without it being requested. I think this will lead to 
overcomplicated lengthy template responses being created when they're not really 
wanted. Most people when making a SAR, still just ask for a copy of the data, and 
many will be a bit bemused if they receive a list of this additional data. As you say, 
referring people to a privacy notice is sometimes going to be an option, but I think 
we should prepare to see some pretty spectacularly confusing responses from data 
controllers trying to follow this guidance to situations where the additional data 
doesn't apply very well. 


Are you answering as: 
C) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
©) An individual acting in a professional capacity 

`) On behalf of an organisation 

(C) Other 

Please specify the name of your organisation: 

my views don't represent my organisation, they're hopelessly incompetent with data protection anyway 
What sector are you from: 

local government 


How did you find out about this survey? 
( `) ICO Twitter account 
_) ICO Facebook account 
(`) ICO LinkedIn account 
(`) ICO website 
( `) ICO newsletter 
(_) ICO staff member 
(`) Colleague 
( ) Personal/work Twitter account 
( ) Personal/work Facebook account 
|) Personal/work LinkedIn account 
( ) Other 
If other please specify: 


